Tag: security
HTTP Cookies in PHP
PHP 7.3+
Cookies are small key-value pairs sent by the server via Set-Cookie and echoed back by the browser on every request — PHP sets them with setcookie() before any output, with Secure, HttpOnly, and SameSite flags controlling safety.
2mo ago
php beginner
HTTPS & TLS
HTTP over TLS — encrypts all traffic between browser and server, preventing eavesdropping, man-in-the-middle attacks, and tampering. Required for cookies, modern APIs, and all production web applications.
2mo ago
security beginner
Hardcoded Credentials
PHP 5.0+
Passwords, API keys, or tokens written directly into source code — permanently exposed to anyone with repository access and impossible to rotate without a code change.
3mo ago
security beginner
hash_equals()
PHP 5.6+
Constant-time string comparison that prevents timing attacks when validating tokens and CSRF values.
3mo ago
php intermediate
htmlspecialchars()
PHP 5.0+
Converts HTML special characters to entities — the primary defence against XSS in HTML output contexts.
3mo ago
php beginner
HTTP Security Headers Checklist
A set of response headers that instruct browsers to enforce security policies — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, and Permissions-Policy.
3mo ago
security intermediate